Changelog

2026-07-23

Added

• Heartbeat system: Automatically starts when the API is enabled, calling /health every 30s to check connectivity; switches to 5s fast retry on failure, and reverts to 30s once restored. The heartbeat is bound to the API toggle – disabling the API stops it.
• Player logout reporting: When a player leaves the game, a POST /login/logout request is sent, reporting player_name, player_uuid, player_ip, and server_id. This shares the logLoginEvents toggle with login events.
• Global server_id propagation: All API requests (/health, /whitelist/sync, /whitelist/entries, /login/log, /login/logout) now forcibly carry server_id. If not configured, "undefined" is used as fallback.
• Warning for missing server_id: When API mode is enabled but serverId is empty, a prominent warning is printed to the console, prompting the server owner to configure it.
• Singleplayer host player detection: Added isHostPlayer() method; the owner of a singleplayer world is automatically allowed and detected via the isSingleplayerOwner API, with log entries marked as [Host Login].
• Server-side translation preloading: Translation files for en_us and zh_cn are preloaded at startup. Kick messages are translated server‑side based on the client’s language, so clients do not need the mod installed to see correct messages.

Changed

• Removed sendServerId config option: server_id is now always sent with every request; the sendServerId setting in the config file is deprecated.
• Removed API_SEND_SERVER_ID config option: The relevant field and build code have been deleted from Config.java.

Fixed

• Inverted isValidForWriting semantics: Previously returned !isActive || !canWrite || isExpired(); corrected to isActive && canWrite && !isExpired().
• Inverted hasValidToken semantics: Previously returned !isTokenVerified.get() || tokenInfo == null; corrected to isTokenVerified.get() && tokenInfo != null.
• Inverted permission checks in sync operations: Token permission checks in syncWhitelist, addEntry, removeEntry, and logLoginEvent were corrected from hasValidToken() || tokenInfo.isValidForXxx() to !hasValidToken() || !tokenInfo.isValidForXxx().
• Inverted getTokenStatus logic: The hasValidToken() condition was corrected from true to !false.
• Local singleplayer players being incorrectly blocked: In isAllowed(), the initial allowed value was changed from false to isHost, so the singleplayer owner is no longer intercepted by the whitelist.
• getPlayerIP security enhancement: No longer directly casts to InetSocketAddress; uses instanceof pattern matching, with fallback for LocalAddress (returns <host> for singleplayer/LAN), and returns "unknown" on exception.
• Blank logs during initialization: Log writing and API login events now include an isLoaded guard, executing only after the whitelist has been fully loaded, preventing empty entries from being generated during mod initialization.

Important

• If you need to use the API functionality, please make sure to use backend version 2.1.0 or higher.